Your IP : 216.73.216.224
U
�]c? � @ s� d Z ddlZddlZddlZddlZddlZddlZddlm Z ddlm
Z
ddl m Z ddl
mZ ddlmZ ddlmZ dd lmZ dd
lmZ dd lmZ dd lmZ dd
lm Z ddl m Z ddl m Z ddl m Z ddl!m"Z" e�#e$�Z%dEdd�Z&dd� Z'dd� Z(dd� Z)dd � Z*d d � Z+d d � Z,d!d"� Z-d#d$� Z.d%d&� Z/d'd(� Z0d)d*� Z1d+d,� Z2e
j3fd-d.�Z4e
j3fd/d0�Z5e
j3fd1d2�Z6d3d4� Z7d5d6� Z8e
j3fd7d8�Z9e
j3fd9d:�Z:d;d<� Z;d=d>� Z<d?d@� Z=dAdB� Z>dCdD� Z?dS )Fz�Certbot client crypto utility functions.
.. todo:: Make the transition to use PSS rather than PKCS1_v1_5 when the server
is capable of handling the signatures.
� N)�SSL)�crypto)�x509)�InvalidSignature)�default_backend)�ECDSA)�EllipticCurvePublicKey)�PKCS1v15)� RSAPublicKey)� crypto_util)�IO)�errors)�
interfaces)�util)�os�key-certbot.pemc
C s� z t | �}W n4 tk
r@ } ztjddd� |�W 5 d}~X Y nX tj�tj�}t �
|d|j � t � t
j�||�dd�\}}|� |�|� W 5 Q R X t�d| |� t �||�S ) a� Initializes and saves a privkey.
Inits key and saves it in PEM format on the filesystem.
.. note:: keyname is the attempted filename, it may be different if a file
already exists at the path.
:param int key_size: RSA key size in bits
:param str key_dir: Key save directory.
:param str keyname: Filename of key
:returns: Key
:rtype: :class:`certbot.util.Key`
:raises ValueError: If unable to generate the key given key_size.
� T��exc_infoNi� i� �wbz Generating key (%d bits): %s)�make_key�
ValueError�logger�error�zope� component�
getUtilityr �IConfigr �make_or_verify_dir�strict_permissions� unique_filer �path�join�write�debugZKey)Zkey_sizeZkey_dirZkeynameZkey_pem�err�configZkey_f�key_path� r( �5/usr/lib/python3/dist-packages/certbot/crypto_util.py�
init_save_key% s �r* c C s� t j�tj�}tj| j||jd�}t �
|d|j � t � t
j�|d�dd�\}}|� |�|� W 5 Q R X t�d|� t �||d�S )a2 Initialize a CSR with the given private key.
:param privkey: Key to include in the CSR
:type privkey: :class:`certbot.util.Key`
:param set names: `str` names to include in the CSR
:param str path: Certificate save directory.
:returns: CSR
:rtype: :class:`certbot.util.CSR`
)� must_staplei� zcsr-certbot.pemi� r zCreating CSR: %s�pem)r r r r r �acme_crypto_utilZmake_csrr, r+ r r r r r r! r" r# r r$ �CSR)�privkey�namesr! r& Zcsr_pemZcsr_fZ csr_filenamer( r( r) �
init_save_csrI s � � r1 c C sJ z t �t j| �}|�|�� �W S t jk
rD tjddd� Y dS X dS )z�Validate CSR.
Check if `csr` is a valid CSR for the given domains.
:param str csr: CSR in PEM.
:returns: Validity of CSR.
:rtype: bool
r Tr FN)r �load_certificate_request� FILETYPE_PEM�verifyZ
get_pubkey�Errorr r$ )�csr�reqr( r( r) � valid_csrl s �r8 c C sT t �t j| �}t �t j|�}z |�|�W S t jk
rN tjddd� Y dS X dS )z�Does private key correspond to the subject public key in the CSR?
:param str csr: CSR in PEM.
:param str privkey: Private key file contents (PEM)
:returns: Correspondence of private key to CSR subject public key.
:rtype: bool
r Tr FN)r r2 r3 �load_privatekeyr4 r5 r r$ )r6 r/ r7 Zpkeyr( r( r) �csr_matches_pubkey� s
� r: c C s� t j}t j}z|t j|�}W nL t jk
rh z|||�}W n& t jk
rb t�d�| ���Y nX Y nX t|�}t �||�}|t j
| |dd�|fS )a/ Import a CSR file, which can be either PEM or DER.
:param str csrfile: CSR filename
:param str data: contents of the CSR file
:returns: (`crypto.FILETYPE_PEM`,
util.CSR object representing the CSR,
list of domains requested in the CSR)
:rtype: tuple
z Failed to parse CSR file: {0}r, )�file�dataZform) r r3 r2 �
FILETYPE_ASN1r5 r
�format�"_get_names_from_loaded_cert_or_reqZdump_certificate_requestr r. )Zcsrfiler< ZPEM�loadr6 ZdomainsZdata_pemr( r( r) �import_csr_file� s rA c C s0 | dks t �t�� }|�tj| � t�tj|�S )z�Generate PEM encoded RSA key.
:param int bits: Number of bits, at least 1024.
:returns: new RSA key in PEM form with specified number of bits
:rtype: str
i )�AssertionErrorr ZPKeyZ generate_keyZTYPE_RSAZdump_privatekeyr3 )�bits�keyr( r( r) r � s r c C s6 zt �t j| ��� W S tt jfk
r0 Y dS X dS )z�Is valid RSA private key?
:param str privkey: Private key file contents in PEM
:returns: Validity of private key.
:rtype: bool
FN)r r9 r3 Zcheck� TypeErrorr5 )r/ r( r( r) �
valid_privkey� s �
rF c C s" t | � t| � t| j| j� dS )a� For checking that your certs were not corrupted on disk.
Several things are checked:
1. Signature verification for the cert.
2. That fullchain matches cert and chain when concatenated.
3. Check that the private key matches the certificate.
:param `.storage.RenewableCert` renewable_cert: cert to verify
:raises errors.Error: If verification fails.
N)�verify_renewable_cert_sig�verify_fullchain� verify_cert_matches_priv_key�certr/ )�renewable_certr( r( r) �verify_renewable_cert� s rL c
C s� z�t | jd��}t�|�� t� �}W 5 Q R X t | jd��}t�|�� t� �}W 5 Q R X |�� }t� � � t
||j |j |j
� W 5 Q R X W nJ tttfk
r� } z&d�| j|�}t�|� t�|��W 5 d}~X Y nX dS )z�Verifies the signature of a `.storage.RenewableCert` object.
:param `.storage.RenewableCert` renewable_cert: cert to verify
:raises errors.Error: If signature verification fails.
�rbz[verifying the signature of the cert located at {0} has failed. Details: {1}N)�open�chainr Zload_pem_x509_certificate�readr rJ �
public_key�warnings�catch_warnings�verify_signed_payload� signatureZtbs_certificate_bytes�signature_hash_algorithm�IOErrorr r r> r � exceptionr
r5 )rK �
chain_filerO � cert_filerJ Zpk�e� error_strr( r( r) rG � s"
� �
rG c C s� t �� �v t �d� t| t�rB| �|t� |�}|�|� |�� n8t| t �rp| �|t
|��}|�|� |�� n
t � d��W 5 Q R X dS )a� Check the signature of a payload.
:param RSAPublicKey/EllipticCurvePublicKey public_key: the public_key to check signature
:param bytes signature: the signature bytes
:param bytes payload: the payload bytes
:param cryptography.hazmat.primitives.hashes.HashAlgorithm
signature_hash_algorithm: algorithm used to hash the payload
:raises InvalidSignature: If signature verification fails.
:raises errors.Error: If public key type is not supported
�ignorezUnsupported public key typeN)
rR rS � simplefilter�
isinstancer
�verifierr �updater4 r r r
r5 )rQ rU ZpayloadrV r` r( r( r) rT � s$
�
�
rT c
C s| z,t �t j�}|�| � |�|� |�� W nJ tt jfk
rv } z&d�| ||�}t �
|� t �|��W 5 d}~X Y nX dS )z� Verifies that the private key and cert match.
:param str cert_path: path to a cert in PEM format
:param str key_path: path to a private key file
:raises errors.Error: If they don't match.
z�verifying the cert located at {0} matches the private key located at {1} has failed. Details: {2}N) r ZContextZ
SSLv23_METHODZuse_certificate_fileZuse_privatekey_fileZcheck_privatekeyrW r5 r> r rX r
)� cert_pathr' �contextr[ r\ r( r( r) rI s
�
rI c
C s� z�t | j��}|�� }W 5 Q R X t | j��}|�� }W 5 Q R X t | j��}|�� }W 5 Q R X || |kr�d}|�| j�}t�|��W nf t k
r� } z"d�|�}t
� |� t�|��W 5 d}~X Y n( tjk
r� } z|�W 5 d}~X Y nX dS )z� Verifies that fullchain is indeed cert concatenated with chain.
:param `.storage.RenewableCert` renewable_cert: cert to verify
:raises errors.Error: If cert and chain do not combine to fullchain.
z.fullchain does not match cert + chain for {0}!z8reading one of cert, chain, or fullchain has failed: {0}N) rN rO rP rJ � fullchainr> Z lineagenamer
r5 rW r rX ) rK rY rO rZ rJ Zfullchain_filerd r\ r[ r( r( r) rH - s"
rH c C s� g }t jt jfD ]J}zt �|| �|fW S t jk
rX } z|�|� W 5 d}~X Y qX qt�d�d�dd� |D �����dS )z:Load PEM/DER certificate.
:raises errors.Error:
NzUnable to load: {0}�,c s s | ]}t |�V qd S �N)�str)�.0r r( r( r) � <genexpr>U s z-pyopenssl_load_certificate.<locals>.<genexpr>) r r3 r= �load_certificater5 �appendr
r> r" )r< Zopenssl_errorsZ file_typer r( r( r) �pyopenssl_load_certificateG s �rl c C s8 z ||| �W S t jk
r2 tjddd� � Y nX d S )Nr Tr )r r5 r r �Zcert_or_req_str� load_func�typr( r( r) �_load_cert_or_reqY s
rp c C s t �t| ||��S rf )r- Z_pyopenssl_cert_or_req_sanrp rm r( r( r) �_get_sans_from_cert_or_reqb s
�rq c C s t | tj|�S )z�Get a list of Subject Alternative Names from a certificate.
:param str cert: Certificate (encoded).
:param typ: `crypto.FILETYPE_PEM` or `crypto.FILETYPE_ASN1`
:returns: A list of Subject Alternative Names.
:rtype: list
)rq r rj )rJ ro r( r( r) �get_sans_from_certi s
�rr c C s t | ||�}t|�S rf )rp r? )Z cert_or_reqrn ro �loaded_cert_or_reqr( r( r) �_get_names_from_cert_or_reqw s rt c C s
t �| �S rf )r- Z _pyopenssl_cert_or_req_all_names)rs r( r( r) r? | s r? c C s t | tj|�S )z�Get a list of domains from a cert, including the CN if it is set.
:param str cert: Certificate (encoded).
:param typ: `crypto.FILETYPE_PEM` or `crypto.FILETYPE_ASN1`
:returns: A list of domain names.
:rtype: list
)rt r rj )r6 ro r( r( r) �get_names_from_cert� s
�ru c C s t �| |�S )z�Dump certificate chain into a bundle.
:param list chain: List of `crypto.X509` (or wrapped in
:class:`josepy.util.ComparableX509`).
)r- �dump_pyopenssl_chain)rO Zfiletyper( r( r) rv � s rv c C s t | tjj�S )z�When does the cert at cert_path start being valid?
:param str cert_path: path to a cert in PEM format
:returns: the notBefore value from the cert at cert_path
:rtype: :class:`datetime.datetime`
)�_notAfterBeforer �X509Z
get_notBefore�rb r( r( r) � notBefore� s rz c C s t | tjj�S )z�When does the cert at cert_path stop being valid?
:param str cert_path: path to a cert in PEM format
:returns: the notAfter value from the cert at cert_path
:rtype: :class:`datetime.datetime`
)rw r rx Z get_notAfterry r( r( r) �notAfter� s r{ c
C s� t | ��}t�tj|�� �}W 5 Q R X ||�}|dd� d|dd� d|dd� d|dd� d|dd � d|d d
� g }d �|�}tjr�|�d �}t �
|�S )
aP Internal helper function for finding notbefore/notafter.
:param str cert_path: path to a cert in PEM format
:param function method: one of ``crypto.X509.get_notBefore``
or ``crypto.X509.get_notAfter``
:returns: the notBefore or notAfter value from the cert at cert_path
:rtype: :class:`datetime.datetime`
r � � -� � � T�
� :� N� �ascii) rN r rj r3 rP r" �sixZPY3�decode� pyrfc3339�parse)rb �method�fr Z timestampZreformatted_timestampZ
timestamp_strr( r( r) rw � s$
�
�
rw c C s: t �� }t| d��}|�|�� �d�� W 5 Q R X |�� S )aN Compute a sha256sum of a file.
NB: In given file, platform specific newlines characters will be converted
into their equivalent unicode counterparts before calculating the hash.
:param str filename: path to the file whose hash will be computed
:returns: sha256 digest of the file in hexadecimal
:rtype: str
�rzUTF-8)�hashlib�sha256rN ra rP �encodeZ hexdigest)�filenamer� Zfile_dr( r( r) � sha256sum� s r� c C s8 t �t jt �t j| ���� }| t|�d� �� }||fS )z�Split fullchain_pem into cert_pem and chain_pem
:param str fullchain_pem: concatenated cert + chain
:returns: tuple of string cert_pem and chain_pem
:rtype: tuple
N)r Zdump_certificater3 rj r� �len�lstrip)Z
fullchain_pemrJ rO r( r( r) � cert_and_chain_from_fullchain� s
�r� )r )@�__doc__r� ZloggingrR r� r� Zzope.componentr ZOpenSSLr r Z cryptographyr Zcryptography.exceptionsr Z cryptography.hazmat.backendsr Z,cryptography.hazmat.primitives.asymmetric.ecr r Z1cryptography.hazmat.primitives.asymmetric.paddingr Z-cryptography.hazmat.primitives.asymmetric.rsar
Zacmer r- Zacme.magic_typingr Zcertbotr
r r Zcertbot.compatr Z getLogger�__name__r r* r1 r8 r: rA r rF rL rG rT rI rH rl r3 rp rq rr rt r? ru rv rz r{ rw r� r� r( r( r( r) �<module> sb
$# �
�